| title | Deploy a Python web app to Azure with managed identity: deploy the container image to App Service |
|---|---|
| description | How to deploy a containerized Python (Django or Flask) to App Service. |
| author | jess-johnson-msft |
| ms.author | jejohn |
| ms.devlang | python |
| ms.topic | tutorial |
| ms.date | 07/27/2022 |
| ms.prod | azure-python |
| ms.custom | devx-track-python, devx-track-azurecli |
This article is part of a tutorial about how to containerize and deploy a Python web app to Azure App Service. App Service enables you to run containerized web apps and deploy through continuous integration/continuous deployment (CI/CD) capabilities with Docker Hub, Azure Container Registry, and Visual Studio Team Services.
In this part of the tutorial, you learn how to deploy the containerized Python web app to App Service using the App Service Web App for Containers. Web App for Containers allows you to focus on composing your containers without worrying about managing and maintaining an underlying container orchestrator.
Following the steps here, you'll end up with an App Service website using a Docker container image. The App Service pulls the initial image from Azure Container Registry using managed identity for authentication.
The service diagram shown below highlights the components covered in this article.
:::image type="content" source="./media/tutorial-container-web-app/containerization-of-python-apps-deploy.png" alt-text="A screenshot of the services using in the Tutorial - Containerized Python App on Azure with deployment path highlighted." lightbox="./media/tutorial-container-web-app/containerization-of-python-apps-deploy.png" :::
Sign in to the Azure portal and follow these steps to create the web app.
| Instructions | Screenshot |
|---|---|
| [!INCLUDE Include showing how to start create process of app service in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/azure-portal-create-web-app-start-create-240px.png" lightbox="./media/tutorial-container-web-app/azure-portal-create-web-app-start-create.png" alt-text="A screenshot showing how to start the creation of a web app in the Azure portal." ::: |
| [!INCLUDE Include showing how to specify basics of app service in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/azure-portal-create-web-app-basics-240px.png" lightbox="./media/tutorial-container-web-app/azure-portal-create-web-app-basics.png" alt-text="A screenshot showing how to fill out the basic deployment information about a web app in the Azure portal." ::: |
| [!INCLUDE Include showing how to specify Docker container of app service info in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/azure-portal-create-web-app-docker-240px.png" lightbox="./media/tutorial-container-web-app/azure-portal-create-web-app-docker.png" alt-text="A screenshot showing how to fill out the Docker deployment information about a web app in the Azure portal." ::: |
| [!INCLUDE Include showing how to finish the create process of app service in Azure portal] |
These steps require the Docker extension for VS Code.
| Instructions | Screenshot |
|---|---|
| [!INCLUDE Include showing how refresh registries in Docker extension in VS Code] | :::image type="content" source="./media/tutorial-container-web-app/visual-studio-code-refresh-registries-240px.png" lightbox="./media/tutorial-container-web-app/visual-studio-code-refresh-registries.png" alt-text="A screenshot showing how to fresh registries in the Docker extension for Visual Studio Code." ::: |
| [!INCLUDE Include showing how call up deploy image command in VS Code] | :::image type="content" source="./media/tutorial-container-web-app/visual-studio-code-docker-registries-build-command-240px.png" lightbox="./media/tutorial-container-web-app/visual-studio-code-docker-registries-build-command.png" alt-text="A screenshot showing how to find the deploy Docker image to App Service task in Visual Studio Code." ::: |
| [!INCLUDE Include showing how to specify the deployment in VS Code] | :::image type="content" source="./media/tutorial-container-web-app/visual-studio-code-deploy-task-prompts-240px.gif" lightbox="./media/tutorial-container-web-app/visual-studio-code-deploy-task-prompts.gif" alt-text="A screenshot showing how to specify the information to deploy Docker image to App Service in Visual Studio Code." ::: |
| [!INCLUDE Include showing how to verify the deployment in VS Code] | :::image type="content" source="./media/tutorial-container-web-app/visual-studio-code-site-deployed-240px.png" lightbox="./media/tutorial-container-web-app/visual-studio-code-site-deployed.png" alt-text="A screenshot showing prompt when Docker image is deployed App Service in Visual Studio Code." ::: |
Azure CLI commands can be run in the Azure Cloud Shell or on a workstation with the Azure CLI installed.
[!INCLUDE Include showing how create web app with Azure CLI]
In Azure portal, follow these steps to enable managed identity.
| Instructions | Screenshot |
|---|---|
| [!INCLUDE Include showing how to enable managed identity for an App Service in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/portal-web-app-managed-identity-enable-240px.png" lightbox="./media/tutorial-container-web-app/portal-web-app-managed-identity-enable.png" alt-text="A screenshot showing how to enable managed identity for an App Service in Azure portal." ::: |
| [!INCLUDE Include showing how to add an Azure role assignment for an app service in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/portal-web-app-managed-identity-role-assignments-button-240px.png" lightbox="./media/tutorial-container-web-app/portal-web-app-managed-identity-role-assignments-button.png" alt-text="A screenshot showing how to add an Azure role assignment for an App Service in Azure portal." ::: |
| [!INCLUDE Include showing how to add an Azure role assignment for an app service in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/portal-web-app-managed-identity-add-role-240px.png" lightbox="./media/tutorial-container-web-app/portal-web-app-managed-identity-add-role.png" alt-text="A screenshot showing an AcrPull role assignment for an App Service in Azure portal." ::: |
| [!INCLUDE Include showing how to specify Docker container deployment with managed identity of app service in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/portal-web-app-managed-identity-in-deployment-240px.png" lightbox="./media/tutorial-container-web-app/portal-web-app-managed-identity-in-deployment.png" alt-text="A screenshot showing how to enable managed identity and container deployment for an App Service in Azure portal." ::: |
| [!INCLUDE Include showing how to specify an Azure Container Registry webhook in Azure portal] | :::image type="content" source="./media/tutorial-container-web-app/portal-web-app-registry-webhook-240px.png" lightbox="./media/tutorial-container-web-app/portal-web-app-registry-webhook.png" alt-text="A screenshot showing how to create a webhook for Azure Container Registry in Azure portal." ::: |
If you deployed the image with Visual Studio Code, managed identity is already set for the App Service to pull images from the registry. You can confirm managed identity is enabled by reviewing the logs of the OUTPUT window and looking for the message "Granting permission for App Service to pull image from ACR...".
Also, a webhook was also created. You can review the webhooks defined for an Azure Container Registry in the Azure portal or with the Azure CLI.
[!INCLUDE Include showing how set managed identity for container deployment with Azure CLI]
In this step, you specify environment variables needed to connect to MongoDB.
| Instructions | Screenshot |
|---|---|
| [!INCLUDE Create app settings in Azure portal 1] | :::image type="content" source="./media/tutorial-container-web-app/azure-portal-create-app-settings-panel-240px.png" lightbox="./media/tutorial-container-web-app/azure-portal-create-app-settings-panel.png" alt-text="A screenshot showing how to add a setting to the App Service in Azure portal." ::: |
| [!INCLUDE Create app settings in Azure portal 2] | :::image type="content" source="./media/tutorial-container-web-app/azure-portal-app-settings-confirm-240px.png" lightbox="./media/tutorial-container-web-app/azure-portal-app-settings-confirm.png" alt-text="A screenshot showing how to confirm settings of the App Service in Azure portal." ::: |
To configure environment variables for the web app from VS Code, you must have the Azure Tools extension pack installed and be signed into Azure from VS Code.
| Instructions | Screenshot |
|---|---|
| [!INCLUDE Create app settings in VS Code 1] | :::image type="content" source="./media/tutorial-container-web-app/visual-studio-code-create-app-settings-240px.png" lightbox="./media/tutorial-container-web-app/visual-studio-code-create-app-settings.png" alt-text="A screenshot showing how to add a setting to the App Service in VS Code." ::: |
| [!INCLUDE Create app settings in VS Code 2] |
[!INCLUDE Include showing how set App Service configuration settings with Azure CLI]
To verify the site is running, go the https::<website-name>.azurewebsites.net. If successful, you should see the restaurant review sample app. Add a restaurant and a review for that restaurant to confirm the sample app is functioning.
If you don't see the sample app, here are troubleshooting steps you can try.
- With container deployment and App Service, always check the Deployment Center / Logs page. Confirm that the container was pulled and is running. The initial pull and running of the container can take a few moments.
- Try to restart the App Service and see if that resolves your issue.
- If there are programming errors, those errors will show up in the application logs. In the App Server, select Diagnose and solve problems/Application logs.
- Since the sample app relies on a connection to MongoDB, confirm you have the application settings with the correct connection info.
- Confirm that managed identity is enabled for the App Service and is used in the Deployment Center. Go to the App Service Deployment Center resource and confirm that Authentication is set to Managed Identity.
- Different Azure Container Registry skus have different features, including number of webhooks. Webhooks are automatically created for you if you followed the steps in this tutorial. However, if you're reusing an existing registry you could see the message: "Quota exceeded for resource type webhooks for the registry SKU Basic. Learn more about different SKU quotas and upgrade process: https://aka.ms/acr/tiers". If you see this message, use a new registry, or reduce the number of registry webhooks in use.